Hidden User Creation (b22a5b36-2431-493a-8be1-0bae56c28ef3)

Detects creation of a hidden user account on macOS (UserID < 500) or with IsHidden option

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Hidden User Creation (b22a5b36-2431-493a-8be1-0bae56c28ef3)	Sigma-Rules	Hidden Users - T1564.002 (8c4aef43-48d5-49aa-b2af-c0cd58d30c3d)	Attack Pattern	1
Hidden Users - T1564.002 (8c4aef43-48d5-49aa-b2af-c0cd58d30c3d)	Attack Pattern	Hide Artifacts - T1564 (22905430-4901-4c2a-84f6-98243cb173f8)	Attack Pattern	2